Skip to content
brandefense.io
Request A Demo
RansomwareFinancial

Ms13089

Ms13089 is a ransomware group with a financial motive, tracked by Brandefense. It targets the Education and Research sector in 3 countries, including Germany and Italy.

Request IOC feedRequest ATT&CK export
Techniques
0
Exploited CVEs
No CVE data
First seen
Dec 18, 2025
Last seen
Aug 15, 2026
Record updated

Who They Target.

Sectors · 1
Countries · 3

About Ms13089.

MS13089 is a newly emerged ransomware group (first observed December 2025) that named itself after a 2013 Microsoft Security Bulletin, claiming a handful of victims including a law firm, operating primarily as a double-extortion actor.

Last updated Sep 22, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.